Remove BrowserID-related code and endpoints once traffic declines sufficiently

[rfk]

As of Firefox 80, we expect all our major clients to have moved away from BrowserID and instead be using OAuth to access all account-related services. The next step in deprecating BrowserID is to wait for traffic from legacy clients to subside, then remove the BrowserID-related code from the FxA server.

First, we'll need to confirm that traffic using these routes has reached a sufficiently low level. Something like:

• Setup monitoring for traffic to the /certificate/sign endpoint, broken down by user-agent and version.
• Confirm that we're not seeing significant traffic from Firefox versions >= 80.
• Wait for the next Firefox ESR, which will include the new OAuth-based sync code from Firefox 80.
• Decide on an appropriate traffic threshold below which we'll disable the /certificate/sign route.
• Wait for traffic to drop below that threshold.

Once we're happy that there's a sufficiently low level of BrowserID-related traffic, we can remove the code including:

• Remove the ability to trade a BrowserID assertion for an OAuth token, and decomission the local instance of browserid-verifier that we currently run to support this.
• Remove the /certificate/sign route and the signer module on which it depends.
• Remove the /.well-known support routes for being a BrowserID IdP.

┆Issue is synchronized with this Jira Task
┆Issue Number: FXA-2715

[data-sync-user]

➤ Jared Hirsch commented:

Leaving this out of the triaged pile so we can talk about it at our next team meeting